Skip to main content

Moby BuildKit CVE-2026-93316

| EUVDEUVD-2026-92527 HIGH
NULL Pointer Dereference (CWE-476)
2026-10-05 Docker
Denial Of Service Null Pointer Dereference Red Hat Suse Moby Buildkit
7.1
CVSS 4.0 · Vendor: Docker
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain build-submission access to BuildKit daemon
  2. Exploit
    Submit build requesting a CDI device
  3. Execution
    Trigger null pointer dereference on disabled CDI path
  4. Impact
    Daemon panics, build service down

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the BuildKit daemon to have been started with the --cdi-disabled flag (a non-default operator configuration), and then a submitted build must attempt to use a CDI (Container Device Interface) device - at which point the disabled code path dereferences a null pointer and panics. Limiting factors: the attacker (or careless user) needs the ability to submit builds to the daemon (PR:L), and the daemon must be running in the --cdi-disabled mode; default deployments that do not set this flag are not affected. Impact is confined to availability (daemon crash) with no confidentiality or integrity loss.
Impact

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VA:H and VC:N/VI:N indicates a network-reachable, low-complexity bug whose only impact is availability - the BuildKit daemon crashes via a null pointer dereference (CWE-476). PR:L confirms some privilege is required: the attacker must be able to submit a build to the daemon, so this is an authenticated/authorized-user DoS rather than an anonymous internet-facing one. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Critically, exploitation is gated on a specific non-default operator choice (the daemon being started with --cdi-disabled), which sharply narrows the real-world exposed population below what the AV:N/AC:L metrics alone would suggest. Net: real but bounded - patch on a normal cadence; treat as urgent only if you run multi-tenant BuildKit with --cdi-disabled.
Exploit ScenarioDerived

An operator runs the BuildKit daemon with the --cdi-disabled flag. A user who can submit builds (maliciously, or simply by accident) issues a build that requests a CDI device; because CDI handling is disabled, the code hits a null pointer dereference and the daemon panics, taking down the shared build service. No public exploit code was provided in the input.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 05, 2026

Denial of service in Moby BuildKit allows a low-privileged remote user to crash the BuildKit daemon by submitting a build that attempts to use a CDI device when the daemon was started with the --cdi-disabled flag. This triggers a null pointer dereference (CWE-476) and daemon panic. The vulnerability requires a non-default configuration and the ability to submit builds; default deployments are not affected. No public exploit has been identified, and the vendor has released a patch in version 0.33.1.

RemediationAI

Upgrade to BuildKit version 0.33.1 or later. The primary fix is available at https://github.com/moby/buildkit/releases/tag/v0.33.1. As a workaround, avoid starting the BuildKit daemon with the --cdi-disabled flag if CDI devices are not used, or if the flag is required, ensure that submitted builds cannot reference CDI devices (e.g., by restricting who can submit builds). Note that default deployments that do not set --cdi-disabled are not affected. Consult the vendor advisory at https://github.com/moby/buildkit/security/advisories/GHSA-r456-g3gm-cvxf for details.

Affected VersionsENISA

buildkit 0 <0.33.1

Affected Packages

euvd buildkit fix: 0.33.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

BuildKit is a toolkit for building container images, part of the Moby project. The Container Device Interface (CDI) allows containers to access specialized hardware. When the BuildKit daemon is started with --cdi-disabled, CDI support is turned off. However, if a build requests a CDI device, the code path still executes and dereferences a null pointer, causing a panic. This is a null pointer dereference (CWE-476) leading to a denial of service. The affected component is the BuildKit daemon, identified by CPE cpe:2.3:a:moby:buildkit. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and high availability impact only.

Know when Buildkit gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Docker) PRIMARY 7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
vuln.today AI 6.5 MEDIUM

Build-submission privilege gives PR:L and network reach AV:N; the crash is deterministic once CDI is requested (AC:L); impact is availability-only (A:H, C:N/I:N) within the daemon (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 6.5 MEDIUM

Primary rating from Vendor (Docker).

CVSS VectorVendor: Docker

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

Technical POC Analysis

Bug class: CWE-476 (null pointer dereference).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Executive ViewAI

Why It Matters

A high-severity denial-of-service vulnerability in Moby BuildKit lets anyone able to submit a build to an affected daemon crash it, disrupting container image builds and the CI/CD pipelines that depend on them. The risk is limited to deployments that were deliberately started with the non-default --cdi-disabled flag; default configurations are not affected, and no public exploit has been identified at time of analysis. Leadership should care because build infrastructure outages can stall software delivery and incident response, though the narrow prerequisite configuration keeps the exposure contained.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 87% exploitable
Prevalence
High
BuildKit is Docker's default build engine, common in CI/CD
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Medium
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Buildkit

View all
CVE-2023-26054 MEDIUM POC
6.5 Mar 06

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. R
CVE-2026-93318 HIGH
7.5 Oct 05

Cache poisoning in BuildKit lets a malicious image advertise DiffIDs that do not match its actual layer contents, so a d
CVE-2026-15793 HIGH
7.3 Jul 21

Argument injection in Moby BuildKit lets a malicious Git source trigger crafted command invocation on the build host whe
CVE-2026-15789 MEDIUM
6.9 Jul 21

Path traversal in the BuildKit daemon allows a client with valid control API access to craft a malicious upload request

CVE-2026-93322 MEDIUM
6.9 Oct 05

Denial of service in Moby BuildKit allows anyone able to submit an LLB build definition to a buildkitd daemon to panic a
CVE-2026-93323 MEDIUM POC
6.8 Oct 05

Denial of service in the BuildKit Dockerfile frontend (buildkitd) allows a user who can submit a build context to exhaus
CVE-2026-15792 MEDIUM
6.0 Jul 21

Denial of service in Docker BuildKit (moby/buildkit) allows a malicious or compromised client or frontend to crash the B
CVE-2026-93326 MEDIUM
6.0 Oct 05

BuildKit (moby/buildkit) contains a policy-validation bypass in which a specially crafted Git source build step makes a

CVE-2026-93320 MEDIUM
6.0 Oct 05

BuildKit, the container build engine used by Docker and exposed through `docker build`/buildx, can be tricked into perfo
CVE-2026-93317 MEDIUM POC
5.9 Oct 05

BuildKit can cache a fetched snapshot under a claimed content digest without adequately verifying that the blob bytes ma
CVE-2026-93315 MEDIUM
5.8 Oct 05

Moby BuildKit (all versions in the affected range per the unbounded CPE cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*) can be

CVE-2026-93319 MEDIUM
5.7 Oct 05

A malicious external BuildKit frontend can issue crafted requests against the daemon's internal API that trigger a data

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

References

Advisories & patches
PATCH https://github.com/moby/buildkit/releases/tag/v0.33.1 ADVISORY https://github.com/moby/buildkit/security/advisories/GHSA-r456-g3gm-cvxf

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy